diff options
author | djm <> | 2010-03-04 11:02:42 +0000 |
---|---|---|
committer | djm <> | 2010-03-04 11:02:42 +0000 |
commit | c87e2fef950513f29035f0902cde1cae8fbaf456 (patch) | |
tree | f4e593c3e9705b2454c89af66d536e4f5e716173 /src/lib/libcrypto/bn | |
parent | eb98df51d4533bcb55eec48a0547d0a3fd3780bc (diff) | |
download | openbsd-c87e2fef950513f29035f0902cde1cae8fbaf456.tar.gz openbsd-c87e2fef950513f29035f0902cde1cae8fbaf456.tar.bz2 openbsd-c87e2fef950513f29035f0902cde1cae8fbaf456.zip |
cherrypick patch from OpenSSL 0.9.8m:
*) Always check bn_wexpend() return values for failure. (CVE-2009-3245)
[Martin Olsson, Neel Mehta]
Diffstat (limited to 'src/lib/libcrypto/bn')
-rw-r--r-- | src/lib/libcrypto/bn/bn_div.c | 2 | ||||
-rw-r--r-- | src/lib/libcrypto/bn/bn_gf2m.c | 3 |
2 files changed, 3 insertions, 2 deletions
diff --git a/src/lib/libcrypto/bn/bn_div.c b/src/lib/libcrypto/bn/bn_div.c index 1e8e57626b..d6ddc9cbe3 100644 --- a/src/lib/libcrypto/bn/bn_div.c +++ b/src/lib/libcrypto/bn/bn_div.c | |||
@@ -102,7 +102,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d, | |||
102 | /* The next 2 are needed so we can do a dv->d[0]|=1 later | 102 | /* The next 2 are needed so we can do a dv->d[0]|=1 later |
103 | * since BN_lshift1 will only work once there is a value :-) */ | 103 | * since BN_lshift1 will only work once there is a value :-) */ |
104 | BN_zero(dv); | 104 | BN_zero(dv); |
105 | bn_wexpand(dv,1); | 105 | if(bn_wexpand(dv,1) == NULL) goto end; |
106 | dv->top=1; | 106 | dv->top=1; |
107 | 107 | ||
108 | if (!BN_lshift(D,D,nm-nd)) goto end; | 108 | if (!BN_lshift(D,D,nm-nd)) goto end; |
diff --git a/src/lib/libcrypto/bn/bn_gf2m.c b/src/lib/libcrypto/bn/bn_gf2m.c index 306f029f27..ae642ccb39 100644 --- a/src/lib/libcrypto/bn/bn_gf2m.c +++ b/src/lib/libcrypto/bn/bn_gf2m.c | |||
@@ -294,7 +294,8 @@ int BN_GF2m_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) | |||
294 | if (a->top < b->top) { at = b; bt = a; } | 294 | if (a->top < b->top) { at = b; bt = a; } |
295 | else { at = a; bt = b; } | 295 | else { at = a; bt = b; } |
296 | 296 | ||
297 | bn_wexpand(r, at->top); | 297 | if(bn_wexpand(r, at->top) == NULL) |
298 | return 0; | ||
298 | 299 | ||
299 | for (i = 0; i < bt->top; i++) | 300 | for (i = 0; i < bt->top; i++) |
300 | { | 301 | { |